-- Recovery bundle storage: encrypted bundles keyed by token_hash.
CREATE TABLE IF NOT EXISTS recovery_bundles (
    token_hash BLOB PRIMARY KEY,
    bundle     BLOB NOT NULL,
    ttl_secs   INTEGER NOT NULL DEFAULT 0,
    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
);